rere writes commits and pull requests into GitOps repositories using a GitHub token, so we treat security reports seriously even pre-1.0.

The project is in early development (pre-1.0); only the latest release and main receive fixes.

Please do not open a public issue for vulnerabilities. Report privately via GitHub Security Advisories. You should receive a response within a week.

rere reads its GitHub token only from an environment variable (git.auth.tokenEnv); tokens must never be committed to config files, and config validation rejects values that look like inline tokens.